undefined | Better HN

0 pointscaptn3m02y ago0 comments

The UPI protocol lets the acquirer lookup this to get additional information, and this is being used by several acquirers, notably Smartbuy@HDFC to provide phone numbers to merchants.

0 comments

3 comments · 1 top-level

sudshekhar2y ago· 2 in thread

I think most data selling happens via branch employees / telecom operators instead of "at the top"

Banks / UPI vendors have to comply with very strict data regulations and the confirmation of a "data leak" is enough to attract heavy penalties from the NPCI and RBI. Most banks and UPI service providers will never risk it, specially post the DEPA guidelines which have recently been adopted.

captn3m0OP2y ago

See this thread on twitter for reports: https://nitter.net/jackerhack/status/1632029845642412033, https://nitter.net/jackerhack/status/1630636510994378752

sudshekhar2y ago

Both these tweets can be addressed by adopting a UPI enabled wallet.

Using Cheq, you can keep your bank account plus mobile number secret. Everyday small value transactions can also be consolidated separately from your main bank account.

I don't think anyone is selling data in the UPI ecosystem but if they are, that's a very short-sighted strategy to make money for sure.

j / k navigate · click thread line to collapse